CISM Information Security Programme Practice Question
Which TWO are key elements of a security awareness program designed to change employee behavior?
⚠ Common exam trap
CISM often tests the difference between awareness activities (posters, annual training) and behavior-change mechanisms (role-based training, simulations) — candidates pick the most visible or compliance-friendly option instead of the one that actually changes behavior.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Role-based training tailored to specific job functions
Option A is correct because role-based training tailors security content to the specific risks and responsibilities of each job function (for example, finance staff trained on BEC/invoice fraud, developers on secure coding), which makes the material relevant and far more likely to change day-to-day behavior than generic content. Option C is correct because phishing simulations provide measurable, experiential reinforcement: users who click are immediately routed into targeted remediation training, converting a real mistake into a teachable moment and building the conditioned vigilance that reduces click rates over time. These two elements combine relevance (A) with active practice and feedback (C), the mechanisms that actually drive sustained behavior change. Option B does not belong because a once-a-year compliance checkbox satisfies audit requirements but is too infrequent and generic to alter habits. Option D does not belong because posters and newsletters are passive awareness artifacts that may raise knowledge but lack the interactivity, personalization, and reinforcement needed to change behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Role-based training tailored to specific job functions
Why this is correct
Role-based training tailors content to each job function's specific risks, making the material relevant and actionable, which drives the behaviour change the programme requires. Generic training fails to connect security requirements to daily tasks, weakening behavioural impact.
- ✗
Annual compliance training for all employees
Why it's wrong here
Annual compliance training satisfies a regulatory attestation requirement, not continuous behaviour change; a once-yearly event cannot reinforce habits or adapt to emerging threats. It is tempting because it is auditable and scalable, and would be the right choice where the objective is documented policy acknowledgement rather than behavioural transformation.
- ✓
Phishing simulations with remediation training for those who click
Why this is correct
Simulated phishing with follow-up remediation training gives employees immediate, experiential feedback on real attack techniques, reinforcing desired behaviour through practise and correction. This closes the loop between awareness and action, satisfying the stem's behaviour-change requirement.
- ✗
Posters and newsletters about security topics
Why it's wrong here
Posters and newsletters broadcast information one-way, which raises awareness but does not measure or reinforce behaviour change through feedback and repetition. They are tempting because they are cheap, visible and easy to deploy at scale, and would suit a campaign whose goal is general security visibility rather than sustained behavioural shift.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.